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The privacy of communicating participants is often of paramount importance, but in some sit- 
uations it is an essential condition. A typical example is a fair (secret) voting. We analyze in 
detail communication privacy based on quantum resources, and we propose new quantum protocols. 
Possible generalizations that would lead to voting schemes are discussed. 



Every day people have to make important decisions 
that should remain secret. Protecting the privacy of 
those decisions, if their results are to be communicated, 
can be a challenging problem. In this Letter we will con- 
sider a special instance of multi-party decision making. 
Consider a group of people who have to make a common 
decision, i.e. choosing one of several possible (prescribed) 
options. In many cases the fairest (democratic) way of 
making the decision is to vote. Reliable voting protocols 
should satisfy a number of conditions [1] , three of which 
are: i) security, ii) verifiability, and Hi) privacy. The se- 
curity condition guarantees that all users can influence 
the result only by casting a single valid vote. That is, 
each voter can vote just once (non-reusability), only le- 
gitimate users can vote (eligibility) and no one can learn 
any intermediate result (fairness). The strongest version 
of the verifiability requirement is that each voter can ver- 
ify the correctness of the result, however none of the vot- 
ers is able to prove how he or she voted. This prevents 
vote buying. 

A voting scheme satisfying all properties except the 
privacy condition is easy to implement. Privacy is re- 
lated to the secrecy of the ballots, or equivalently to the 
anonymity of the voters. Ideally, no one should be able to 
tell how any of the voters voted. Such multi-party com- 
munication protocol is known as secret, or anonymous 
voting. 

In the voting process the initial information Ii cre- 
ated by voters (their votes) is transformed into the fi- 
nal outcome corresponding to the information Usu- 
ally Ii is much larger than If. The voting can be for- 
malized as mapping V : X X . . . X X — > Y, where 
X, Y represent sets of individual voting options and a 
set of final results, respectively. The input/output in- 
formation can be expressed in terms of the cardinali- 
ties of the sets X, Y, i.e. I, = Alog 2 |A| (N is the 
number of participants) and If = log 2 |V|. For exam- 
ple, N parliamentarians during a voting procedure cre- 
ate Ii — A^log 2 3 bits of information, given the choices: 
X = {accept, ref use, abstain}. However, the final re- 



sult can be represented only by If = log 2 3 bits with 
Y = {acceptance, refusal, undecided}. 

Hiding the identity of the voters seems to be very dif- 
ficult to achieve, because the information can often be 
traced back to its origin. In a public election the collected 
paper ballots are mixed in a ballot box, which could en- 
sure the anonymity of a voter. However, the ballots could 
be marked in such a way that it is possible to identify the 
voters. Thus perfect privacy no longer holds. The first 
protocol to guarantee voting privacy (see Ref. [2]) was 
based on the so-called MIX net machines. Since then 
several secret voting protocols based on cryptographic 
primitives such as anonymous broadcast [2] or blind sig- 
natures [3, 4], have been proposed. Some of the prop- 
erties of these protocols are even unconditionally secure, 
and others are guaranteed in the computational sense, 
i.e. they are based on one-way functions. David Chaum 
[5] suggested a solution of the so-called dinning cryptog- 
raphers problem that can be used to implement a secret 
voting protocol. Let us briefly describe this procedure, 
which guarantees unconditionally the anonymity of the 
voters. 

Three cryptographers are having a dinner in their fa- 
vorite restaurant. After ordering their food, the waiter 
comes and informs them that someone has already paid 
for the dinner. The problem is to determine whether it 
has been paid for by one of them, or by someone else 
(for instance, by the NSA). The cryptographer who paid 
(if indeed one of dinning cryptographers took care of the 
bill) wants to remain anonymous. The three cryptogra- 
phers can resolve the problem by using the following pro- 
tocol: Each pair {j, k}; (j, k = 1,2, 3) of cryptographers 
toss a coin, i.e. they generate a random bit Cjk- The 
third cryptographer cannot see the result. Each cryptog- 
rapher announces the logical (mod2) sum of the two bits 
he shares, i.e., the cryptographer k announces the value 



Sk 



= E 



unless he is the one who paid for the din- 
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ner. The one who paid the bill announces the opposite 
value, i.e. Sk = 1 + Ej^fc c jk- If the dinner was paid by 
the NSA then ^ s k = 0. If not, then J2k s k = 1 - Tne 
identity of the potential payer remains completely secret. 

This protocol can be easily extended to an arbitrary 
number of users, and a slightly modified version can be 
used for voting. Each pair of voters shares a random in- 
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teger (key) \cjk\ < N, where Cjk = —Ckj- Each voter 
chooses either v k = ("no") or v k = 1 ("yes"). He 
broadcasts the message s k = v k + J2j^k c jk- Because 
of Cjk = —Ckj it is valid that J2k s *= = Z)fc w *- Finally, 
each of the users can compute the sum and find out the 
total number of the "yes" votes. Let us note that all 
operations are modulo N. Privacy in this scheme is as- 
sured, but the protocol is not secure and cheating is easy. 
One cannot guarantee that voters will not "vote" an arbi- 
trary number times Vk < N, i.e. the result can be easily 
manipulated. However, there exists a modification that 
solves this problem and provides security based on the 
RSA protocol (for more details see Refs. [3, 5]). 

We would now like to consider whether the paradigm 
and tools of quantum (information) theory and in par- 
ticular, the quantum cryptography [6] can help us imple- 
ment tasks related to secret voting and maintaining the 
anonymity of the voters. 

The first analysis of identity protection based on quan- 
tum protocols was performed by Christandl and Wehner 
(see Ref. [7]), who used generalized GHZ states to anony- 
mously broadcast not only classical bits, but also qubits. 
Recently, two approaches (see Refs. [8] and [9]) to quan- 
tum voting have been independently proposed. In Ref. [9] 
Vaccaro et al. have proposed a scheme for quantum vot- 
ing, in which the quantum protocol is used to ensure the 
voter's privacy. In their scheme, the voters and an au- 
thority share an entangled state with a fixed number of 
particles, N. This state is a superposition of states of 
the form \N — n,n), where the the first number is the 
number of particles possessed by the authority and the 
second is the number of particles possessed by the vot- 
ers. The number of yes votes in encoded in the relative 
phases of the states making up the superposition. In 
Ref. [8] quantum approaches towards privacy and voting 
based on entangled qudit states have been discussed. The 
quantum-voting protocol introduced there is the subject 
of this paper. Both these protocols utilize similar re- 
sources, i.e. the ballot (voting) state in both cases is a 
maximally entangled state, and each voter registers his 
vote by a local operation. On the other hand, the two ap- 
proaches suggest different implementations of quantum 
voting. Both will need further development. 

A closely related problem of anonymous oblivious 
transfer has been studied in Ref. [10]. The privacy prob- 
lem is relatively new even in classical information theory. 
It seems (at least intuitively) that quantum systems may 
be more suitable and more efficient in achieving this goal. 

Let us start with the analysis of the privacy and the 
voting problem in the framework of quantum theory. Our 
aim is to use quantum information to ensure privacy. In 
principle, one can imagine two general schemes for a vot- 
ing procedure: i) the distributed-ballots scheme (DB) 
and ii) the travelling-ballot scheme (TB). In the DB a 
voter obtains his own ballot, he or she performs voting 
operation and sends the ballot back. The TB is a scheme 
in which a single ballot/container is travelling (is sent) 
between voters and everyone performs the voting opera- 



tion on the same physical system. Both, the DB and the 
TB scenarios can be formalized in the same way. Physi- 
cally quantum voting is performed by transformations of 
some quantum system. Let us denote by |f2o) the initial 
state of the system (the quantum ballot) and by Ujf' a 
transformation performed by the jth user voting for the 
option k E X. After the voting has concluded, the ballot 
is sent to the authority, who performs a measurement M 
on the ballot. The outcome of the measurement r is asso- 
ciated with the result of the voting, r e Y. Let us denote 
by v = (fci, . . . , k n ) the particular collection of votes and 
by V(v) € Y the result of the process of voting. After the 
voting is completed the system is described by the state 
|fi#) = uj^ . . . Uj^ |Oo). The difference between these 
two schemes is that in the DB scheme we work with a 
composite system of N particles, and the operations for 
different users mutually commute. 

In what follows we will assume that the initial state 
|f2o) is pure and voting operations are represented by 
unitary maps. The privacy of votes is reflected by the 
following set of conditions 

KfieJiWI =«, iff V(vi)^V(v 2 ) ; (1) 
1(^10^)1 = 1, iff V(tfi) = V(tfc) . 

These conditions guarantee that finally only bits of 
information are available and the identity of the voters is 
securely hidden. Our task is to find collections of voting 
operations {Ujf^} and an initial state |fio) such that the 
above conditions are satisfied. In what follows we will 
simplify the task by assuming that each participant uses 

the same collection of operations, i.e. = Jjjf ' = Uk 
for all j, f and all k. 

Let us start by analyzing the simplest case of two vot- 
ers. In this case the privacy property does not make much 
sense, because after a public announcement of the re- 
sult each voter can deduce how the other participant has 
voted. However, it can be of interest to some third party, 
particulary in the case of an undecided result, i.e. when 
votes do not coincide. Let us consider the TB scheme 
first. The set of possible results restricts from below the 
dimension of the required quantum system, i.e. dimW > 
\y\. In our case Y — {acceptance,refusal, undecided} 
and consequently at least a qutrit is needed to perform 
the voting. Let us assume the state |fio) = |0) and vot- 
ing transformations U no = I and U yes = U , where U is 
defined via transformations |0) — > |1) — > |2) — > |0). It 
is easy to verify that Eqs. (1) are fulfilled, however this 
system does not guarantee the secrecy of votes. In the 
proposed protocol it is very easy to learn the actual state 
of the voting, i.e. the intermediate result. One way to 
avoid this problem is to use an authority who prepares 
the initial state of the ballot and finally reads the result. 
We shall now show how this can protect voter privacy. 

In what follows we present a protocol with an honest 
(non-cheating) authority that utilizes entangled states: 
The authority prepares two qutrits that serve as a ballot 
in a maximally entangled state |f2o) = ~m (1 00) + |H) + 
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1 22)). One of the qutrits is sent to the voters. Using 
the voting operation U yes they produce mutually orthog- 
onal states associated with mutually exclusive results of 
voting. In this way one can guarantee that intermedi- 
ate measurements performed individually by voters who 
might want to learn an intermediate voting result provide 
no information about how the voting has progressed. The 
state of the particle seen by the voters is, at all times, 
simply a total mixture. This protocol can be directly gen- 
eralized to N participants by choosing the ballot state to 
be |fi ) = ^= J2k=o \ k )\ k ) and navm g U yes \ k) = |fe + l). 
There is a possibility of voter collusion in this scheme. If 
two voters want to find out how the voters between them 
voted (how many total yes votes these voters made) then 
the first voter can measure the second particle of the bal- 
lot state when he gets it, placing it in one of the states \k) 
and disentangling it from the first particle, and then the 
second colluding voter can again measure second ballot 
particle when he receives it. By comparing their results, 
they can determine the number of yes votes cast by the 
people who voted between them. There is a rather high 
cost to this type of cheating, however; the result of the 
voting as determined by the authority will be completely 
random. 

Next we shall again consider the case of two voters, 
but we shall analyze the DB scheme. Let us start with 
the assumption that each of the participants obtains a 
ballot represented by a single qubit. In the previous 
paragraph we have argued that the system has to be 
at least three-dimensional. Although the system of two 
qubits is four-dimensional, the DB scheme allows the 
users to make only local voting operations, i.e. singlc- 
qubit unitary transformations. The question is, whether 
two qubits are sufficient to implement secret voting. Sup- 
pose that Uo, U\ and Vq,V\ are voting operations of the 
voters named U and V, respectively. Let us denote by 
|flo) the initial state of the two ballot qubits. The privacy 
conditions (1) yield the following system of equations 

= (n \ut l u 1 ®i\n ) = (n \i®v3v 1 \n ) ; (2) 

1 = (fiolE/jE/ifcViVolfio) ; (3) 
= (Qol^i^oWo ; (4) 
= (Slo\utUo(8>I\no) = <O |7® ^Volfto) • (5) 

Due to the fact that UqIIi and VqVi are unitary singlc- 
qubit transformations, they can be expressed as UqIIi = 
Icosf + i(rh ■ (?) sinv and VqVi = I cosO + i(n ■ a) sin#. 
It also holds that (t^t/i)* = U\U Q and (V Vi)t = V}V Q . 
^From Eqs. (2) and (3) it follows that 

cosi/cos# + sin^sin#(fi |n • <?<8> rh ■ ct|O ) = 1 , (6) 

which together with Eq. (4) results in the condition 
2 cos v cos 9 = 1. However, combining Eqs. (2) and (5) we 
find that cos 9 = and cos v = 0. This is a contradiction 
and therefore two-dimensional systems are not sufficient 
to implement the DB scheme. One needs at least two 



qutrits. Note that in the DB scheme the fairness require- 
ment holds, i.e. nobody can learn intermediate results. 

To proceed further let us recall the following prop- 
erty. If the protocol (|f2 ),{t4}) satisfies the privacy 
conditions, then so does the protocol (|Oq), {U' k }), where 
U' k = U k V and \Sl' ) = (V® N )i\Sl ). This means we can 
always choose Uo — I 1 i.e. without the loss of generality 
we can assume that U no = I and U yes = U. Applying 
the privacy conditions from Eq. (1) we obtain equations 

(n \u® u\n ) = 0; 

(SIq\U 2) I\Qq) = 0; 

(n Q \i(g>u\n Q ) = 0; 

(Oo^O u\n Q ) = 1 . (7) 

Our task is to find a solution of this set of equations. 
Because U is unitary, its eigenvalues are of the form e vqj 
and U — e lVj \j)(j\, where \j) is the eigenvector cor- 
responding to the eigenvalue e ir,i . Let us consider the 
state |f2 ) = J2j \ a j\ 2 \j) ® where, again, {\j}} are 
eigenvectors of U. Using this Ansatz the above identi- 
ties gives us the following equations J2j \&j\ 2 e l2vj = 0, 
J2j Kl 2 e"^ = 0, and £\ \ aj \ 2 = 1. The last of these 
equations is just the normalization condition for the state 
|f2o), and is satisfied. We have already shown that a qubit 
is not a sufficient resource for quantum voting and larger 
dimensional systems have to be sent to both voters. As- 
suming d = 3 we find that the equations for parameters 
r]j,aj have multiple solutions. Here, however, we will 
restrict ourselves to |aj| = l/Vd = l/VS. The possible 
solutions then form a one-parameter set and among them 
is the following one 

U = e t27r / 3 |0)(0| +e l47I ^\l)(l\ +e i67r / 3 |2)(2| ; 

|fi ) = -±=(|0)|0) + |1)|1) + |2)|2)). (8) 

This solution can be easily extended to an arbitrary 
number of participants. Let us suppose that there are 
N voters and the authority that distributes one qu- 
dit (d > N) to each voter. In accordance with the 
case of two voters let the authority prepare and dis- 
tribute the state |fi ) = ^ Ej li)* 8 ^- Th e voters will 
apply one of the two operations: cither U no = I, or 
U yes = U = J2k elk27T/d \ k )( k \' depending on their de- 
cision. After performing the voting operations they send 
the qubits back to the authority, who now possesses the 
state \Q m ) = U® m ®I®( N - m )\n ) = Y /k e lmk27T / d \k)® N , 
where m is the number of voters who choose to vote 
"yes" , i.e. the result of the voting. Note that this state 
contains no information about the particular voter, only 
the total number of "yes" votes is recorded. This guar- 
antees the privacy of the individual votes. The distin- 
guishability of different outcomes (different numbers of 
"yes" votes) is guaranteed by the orthogonality condi- 
tion i.e. (0 TO |f2 m /) = 5 mm i. 

This protocol protects the identity of the voters from 
a curious, but not malicious, authority and from other 
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voters. We assume that the authority follows the proto- 
col, but does whatever he can beyond this to determine 
the individual votes. In this case, because the state he 
receives contains no information about who voted how, 
he can do nothing. If, after the voting, a voter intercepts 
a particle from another voter, he will be able to learn 
nothing, because any subset of particles has a reduced 
density matrix proportional to the identity. 

The protocol can also be used in the dinning- 
cryptographers problem. It has further uses as well. A 
simple generalization of the protocol can be used also for 
what was called in Rcf. [9] an anonymous survey. Imag- 
ine that N people want to determine the total amount 
of money they have, but each individual does not want 
reveal how much money he or she has. These people use 
the same method, except that each person votes "yes" a 
number of times corresponding to the number of Euros 
(s)he has. In the resulting state, |f2 m ), m will be equal 
to the total number of Euros, but the contributions of 
individual partners will be unknown. This is an example 
of quantum secure function evaluation [11, 12]. 

In a sense this voting protocol can be thought of as a 
generalization of the classical scheme. However, like its 
classical counterpart, it does not completely possess the 
properties of the security and the verifiability. In fact, we 
have focused our attention mainly on the un-traceability 
of voters ( privacy). To achieve a completely secure vot- 
ing scheme the protocol has to be improved. One of 
the security loopholes is the possibility for voters to vote 
more than once. This type of cheating, however, is not 
guaranteed to produce the desired result, because the 
states |O m ) count only the number of "yes" votes mod- 
ulo d. If too many voters vote "yes" too many times, the 
number m can become larger than d, and because |O m ) 
records the number of "yes" votes only modulo d, the 
final recorded number m could be small. In fact, even if 
there is a subset of cooperating voters it would be diffi- 
cult to know what the effect of such cheating would be, 
and the voting process would become a strategic game. 

In order to prevent voters from registering more than 
one vote (a complete non-reusability of ballots) we can 
proceed as follows: Besides the qudit from the state | O ) 
each of the participants receives two additional "voting" 
qudits, one in the state \ip(9 y )} and the second one in the 
state \ip(9 n )). These two qudits represent the "yes" and 
the "no" votes, respectively. Both of the states are of the 
form |V>(6>)) = ^Efc elfcf, | fc )- The an S le 6 y is ecmal to 
(2l y Tr/d) +5 and 9 n is equal to (2l n ir/d) + 5, where l y and 
l n are integers between and d and 5 is an angle between 
and 2ir/d. In addition, we assume that (l y — l n )N < d, 
where, as before, N is the number of voters. This con- 
dition is necessary in order that different voting results 
be distinguishable. The integers l y and l n and the angle 
<5 are not known to the voters. Depending on his (her) 
choice the voter combines either \tp(9 y )}, or \ip(9 n )}, with 
the original ballot particle, i.e. creates a system com- 
posed from the ballot and the voting qudits. Then (s)he 
performs a two-qudit measurement that is specified by a 



set of projectors P r = ^ - \j+r)b(j+r\(&\j) v (j\, where the 
subscript b denotes the ballot qudit while the subscript v 
denotes the voting qudit. Registering the outcome r the 
voter applies the operation V r = lb <8> \ j + r )v(j\ to 
the voting qudit and sends both (the ballot and the vot- 
ing) qudits back to the authority. The remaining unused 
qudit must be kept, or destroyed in order to secure the 
privacy of the registered vote. Let us see how this works 
in a bit more detail for the first voter. Assuming the 
vote "yes" we obtain P r (^ £ fc |ft)M0 w ))|fc)® (JV_1) ) = 

\Y,k ei{k ~ r)6y \ k )\ k - r )\ k )® {N ~ 1] ■ After the "correcting" 
unitary operation V r the N + 1 qudits are in the state 
|O x ) = -t= e -ire y j2 k e lke y\k)®( N+1 \ where the global 

phase e~ lr6y is irrelevant. If m y = m the voters voted 
"yes" and m n = N — m voters voted "no" , the authority 
gets back the state | fl m ) = ^- ]T fc e ifc ( m « e «+ m " e ")|fc)® 2Ar . 

Here the phase factor can be rewritten as follows 

e ik(m y e y+mn e n ) = e ik m A e ikNe n ^ where A = 9 y - 9 n = 

2n{l y - l n )/d. Because the states J2 k e v P k27V ' d \k) mN are 
orthogonal for different values of p, for p an integer be- 
tween and d — 1, we see that from the state |fi m ) the 
authority can determine the value of p corresponding to 
this state, which is just m(l y — l n ). This allows him to 
determine m, because he knows both l y and l n . Note 
that p should always be a multiple of l y — l n if the voters 
are using their proper ballot states. If after measuring 
the ballot state, the authority finds a value of p that is 
not a multiple of l y — l n , then he knows that someone 
has cheated. A voter who wants to vote more than once 
is faced with the problem of determining what 9 y or 9 n 
is, and this cannot be done from just a single state. In 
fact, what the voter is faced with is a problem of phase 
estimation, and the best he can do is to determine the 
phase to within an accuracy of order l/d. If he makes 
an error (illegal operation), the value of A will not, in 
general be a multiple of 2w/d, and this will cause the au- 
thority to obtain different results for m if the voting pro- 
cedure is repeated several times. The choice l y — l n = ±1 
maximizes the chance of different results being found if 
cheating has occurred, and thereby makes it most likely 
that the cheating will be detected. We also note that 
the no-cloning theorem makes it impossible for a voter 
to simply copy the voting states. Summarizing, we see 
that the casting of multiple votes can be prevented by the 
use of voting states and repeating the voting procedure 
several times in order to make sure that the result is the 
same each time. If the results vary, cheating is taking 
place, and the results are discarded. 

If the authority is malicious as well as curious, one 
of the new security problems that arises is that of the 
state identification, i.e. verifying whether the initial bal- 
lot state is correct, and whether the voting states pro- 
vided by the authority are also correct. The authority 
could cheat either by sending a ballot state that is a 
product state, so that each voter's particle is decoupled 
from all of the others, or by sending voting states that are 
different for each voter. In principle, if the authority is 
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required to supply a large number of both kinds of states 
to the voters, they can verify the correctness of the states 
by performing state tomography. A less drastic test is for 
the voters to take subsets of ballot particles or subsets 
of voting particles corresponding to the same choice (all 
yes or all no) and to measure them. For example, a set 
of " yes" voting states can be measured in order to deter- 
mine whether the state is completely symmetric or not. 
If it is not, then the authority is trying to cheat by send- 
ing different voting states to different voters. Another 
possibility, at least in regard to the ballot state, is for 
the voters to prepare that state by themselves. However, 
this is second option is somewhat restrictive, because it 
requires that participants (voters) have to meet as the 
same place (or they need quantum resources for a re- 
mote state preparation). This problem could perhaps be 
addressed by having two authorities, one who prepares 
the states and one who counts the votes. Here one would 
have to assume that they are not both dishonest and co- 
operating with each other. Clearly much work remains 
to be done. 

In summary, we have proposed quantum protocols that 
guarantee the anonymity of participants in voting proce- 
dures and can be used in several complex communication 
tasks. The advantage of quantum voting protocols is that 
security that is based on the laws of quantum mechanics 
rather than assumptions about computational complex- 
ity. Our approach to quantum voting is based on voters 



applying local operations to an entangled state, a fea- 
ture it shares with the approach proposed by Vaccaro 
et al. [9]. As we have noted, the approaches discussed 
here are based on entangled states of qudits, while in [9] 
particle number entanglement is used. This would sug- 
gest that the schemes would lend themselves to different 
physical implementations. Within our approach, we have 
presented a method of preventing voters from cheating, 
that is from casting more than one vote. Hence, for the 
attacks discussed here, this scheme can meet two require- 
ments for a voting system, privacy and security. The are 
still many questions that remain open and deserve fur- 
ther detailed investigation. Primarily, it is the analysis 
of the security of quantum voting against more sophis- 
ticated attacks, such as collaborating parties, the use of 
illegal voting operations, and cheating authorities that 
deserve further attention. In addition it would be useful 
to find physical implementations for some of these pro- 
posals for small numbers of voters that might enable a 
prototype system to be constructed. 
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